One Telegram Post, 2,162 Hotmail Passwords Exposed by CHEETAH

In early March 2025, HEROIC analysts spotted a small stealer log posted to Telegram by a user going by CHEETAH, titled 2.2K Fresh HotmailHits. The file contains 2,162 exposed records, each pairing a Hotmail email address with a plaintext password and the URL of the login page it opens, the signature output of malware that scrapes saved credentials from an infected browser.

One Telegram Post. 2,162 Hotmail Accounts Exposed.

The word Fresh in the file's name is a marketing term sellers use to signal that these credentials were harvested recently and have not yet been widely circulated, which usually means the passwords are still active. For each of the 2,162 people in this file, that freshness is exactly what makes the leak dangerous.

What Was Exposed in the HotmailHits File

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

Hotmail accounts are frequently used to recover passwords for banking, shopping, and social media accounts, so a compromised inbox can quickly cascade into access to other services. If any of these 2,162 people reused their Hotmail password elsewhere, they face a direct risk of credential stuffing and account takeover.

How a Fresh Hits File Like This Gets Made

Sellers who go by handles like CHEETAH run or buy access to infostealer malware that infects victims through cracked software or malicious downloads, then quickly package newly harvested credentials before they can be flagged or changed. Labeling a file fresh and attaching a personal handle is a branding tactic used to build a reputation and attract buyers on Telegram.

Check If You Are Affected

If you use a Hotmail address, checking whether it appears in this leak takes only a moment. HEROIC's free breach scanner searches a database of more than 400 billion compromised records so you can confirm in seconds whether your email and password showed up in this leak or any other breach.